Privacy Notice

A. If you are a Hullkit customer

What we collect about you: account information you provide (name, email), organization membership and role, platform connections you authorize (which platforms, not the credentials themselves in readable form — see “How we protect data” below), the monitors/queries you configure, and your own actions in the product (approvals, dismissals, dispositions on leads).

Why: to operate the service you signed up for — this is processing under contract performance (GDPR Art. 6(1)(b)) and our legitimate interest in running and improving the service (Art. 6(1)(f)).

What we don't do: we never publish or send anything on your behalf without your explicit approval. There is no setting, anywhere, that lets an AI-drafted reply go out automatically after a delay — every send requires an explicit human click from someone at your organization. This is a fixed architectural property of the product, not a configuration we could change without rebuilding it.

Retention: your account and organization data is retained for as long as your organization has an active subscription, after which it is deleted or anonymized except where we're required to retain it (e.g. billing records for tax or audit purposes).

Your rights: access, correction, deletion, and export of your own account data — contact andrew@hullkit.com.

B. If you never signed up for Hullkit

Why you're getting this notice at all: one of our customers uses Hullkit to monitor public posts and comments on social platforms for content matching keywords they've configured, as part of identifying potential customers for their own business. Today that's Telegram, Bluesky, YouTube. We've also built support for WhatsApp, Instagram, Threads — for a business's own account only, with their own consent — but those are pending platform approval and not yet connectable; see hullkit.com for current availability. If you posted something publicly that matched one of those searches on a platform we actively support, Hullkit may have processed it. We do not access anything private — only content visible on the platform's own public surfaces, through that platform's official API.

What we collect: the text of the public post/comment, your public author handle as shown on the platform, when it was posted, and — generated by us, not collected from you — a sentiment/interest score computed by an AI model, used only to help our customer decide whether to review the post.

Legal basis: legitimate interests (GDPR Art. 6(1)(f)) — our customer's interest in identifying prospective customers from public commentary, and ours in providing that service. We weigh this interest against your rights before relying on it.

Retention: content we've captured is retained only for a limited period set per platform (for example, content sourced from YouTube's API is retained for a maximum of 30 days unless it's re-verified as still public and current).

Your rights: you can ask us to tell you what we hold about your public content, correct it, or delete it, without needing to know which of our customers' monitors matched it — contact andrew@hullkit.com. We verify requests and respond within a reasonable time.

One limit we want to be upfront about, not bury: if your public post was already used as the basis for an AI-drafted reply that a human at our customer's organization approved and sent, we remove the post's text and identifying details from our systems, but in that specific case we may retain an inert record that a post of that type existed and when (not its content, its author, or where it was) alongside the approval record — who approved the reply, when, and what was sent — because that record can't be silently lost without undermining our ability to prove a human, not an automated system, approved every reply. Fully removing even that inert record is possible but requires a documented, counsel-reviewed decision, since doing so also destroys the approval record it's linked to.